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(54) System and method for linking an indicium with a mailpiece in a closed system postage 
meter 



(57) System and method for adding addressing 
information to an indicium printed by a closed system 
metering device (150). A scanning device (120) is cou- 
pled to a closed system postage meter (150) for scan- 
ning addressing information (10) printed on a mailpiece 
(5). The addressing information (10) is combined with 
other information relating to the postage payment for the 



mailpiece to obtain postal data relating to the mailpiece 
(5). The postal data, including the addressing informa- 
tion is used to generate an indicium for the mailpiece 
(5). The indicium includes cryptographic evidencing of 
postage payment. The closed system metering device 
prints the indicium on the mailpiece (5). 
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Description 

[0001] The present invention relates generally to 
postage printing systems. More particularly, the present 
invention is directed to closed system postage metes 
that print digital indicia. 

[0002] This application is related to the following co- 
pending applications filed concurrently herewith and 
commonly assigned to the assignee of this application: 
European Patent Application Number (Applicant Docket 
No. E-742), entitled SYSTEM AND METHOD FOR 
AUTOMATICALLY PROVIDING VALUE ADDED SERV- 
ICES WITH A CLOSED SYSTEM METER; and Euro- 
pean Patent Application Number (Applicant Docket No. 
E-743), entitled CLOSED SYSTEM METER HAVING 
ADDRESS CORRECTION CAPABILITIES. 
[0003] The vast majority of the Posts around the 
world require prepayment for postal services provided 
by the Posts. This allows the Posts to avoid the substan- 
tial time and cost associated with a post-payment sys- 
tem that requires processing billing data and collecting 
and processing remittance. Prepayment, however, 
necessitates that individual mailpieces carry verifiable 
evidence of paid postage. The traditional postage stamp 
is a prime example of such evidence. Although postage 
stamps are good for many applications by low volume 
mailers, for moderate to high volume mailers the appli- 
cation of stamps is difficult and costly and is subject to 
theft. Furthermore, stamps do not provide information 
such as date and place of mailing and provide limited 
postal revenue security. 

[0004] Arthur Pitney invented the first postage 
meter in 1902 to alleviate some shortcomings of post- 
age stamps. This postage meter was a mechanical 
device with securely coupled printing and accounting 
functions. The mechanical meter became a widespread 
basic business machine. With the advent of the micro- 
processor, the accounting and machine control func- 
tions were computerized when electronic postage 
meters were introduced in the late seventies. This ena- 
bled new features, including departmental accounting 
and computerized meter resetting. However, the funda- 
mental security of postage evidencing remained the 
same. 

[0005] Postal revenue security in the analog post- 
age meters, such as the mechanical and electronic 
postage meters, depends on two features: 1) physical 
security of the printing process, i.e., printing of postage 
evidence can not occur without appropriate accounting, 
and 2) forensic detectability, i.e., fraudulent postal indi- 
cia can be distinguished from legitimate indicia. 
[0006] Coupling the printing and accounting mech- 
anism within a secure tamper-evident enclosure pro- 
vides physical security of printing. Inspection of the 
device normally reveals tampering. Effective forensic 
detectability of fraudulent postal indicia depends on 
non-availability of alternative mechanisms suitable for 
forging indicia. Before the proliferation of inexpensive, 



high print quality computer printers, serious attempts to 
generate fraudulent indicia using an alternate printing 
mechanism were detectable. 

[0007] Today, the availability of inexpensive compu- 

5 ter-driven printers provides opportunities for customer 
convenience and cost advantages for printing postage 
evidence. However, the use of such printers requires a 
new way of securing postage, which was first suggested 
in U. S. Patents Nos. 4,641,347, 4,641,346, 4,757,537, 

w and 4,775,246. At that time, it was realized that the 
security of postage evidencing depends on the security 
of the information printed in the indicium, including mes- 
sage authentication and integrity. U. S. Patents Nos. 
4,831,555 and 4,725,718 extended this idea to unse- 

15 cured printing of postage disclosing the necessity that 
at least some of the information in the indicium must 
appear random to a party not in possession of some 
secret. Such random looking information is commonly 
referred to as a digital token. 

20 [0008] The basis of postal revenue security in the 
digital world is two new requirements: 1) security of the 
digital token generating process, i.e., digital tokens can 
not be generated without appropriate accounting, and 
2) automatic detectability, i.e., fraudulent digital tokens 

25 can be detected by automatic means. 

[0009] A cryptographic transformation applied to 
selected data on the mailpiece produces the digital 
token. The data may include postage value, date, postal 
code of the geographical deposit area, recipient 

30 address information, meter data, and piece count. Such 
data is commonly referred to as postal data. The secret 
used to generate the digital token is generally a crypto- 
graphic key held within the accounting device. A verifier, 
with access to a verifying key corresponding to the 

35 accounting device secret, validates the digital token. 
Several cryptographic algorithms and protocols have 
been considered for this purpose. U. S. Patent 
4,853,961 describes critical aspects of public-key cryp- 
tography for mailing applications. See Jose Pastor, 

40 "CRYPTOPOST ™ A Universal Information-Based 
Franking System for Automated Mail Processing", Pro- 
ceedings of the Fourth Advanced Technology Confer- 
ence of the U. S. Postal Service, Vol. I, pp. 429-442, 
Nov. 1990. See also Jose Pastor, "CRYPTOPOST ™ A 

45 Cryptographic Application to Mail Processing", Journal 
of Cryptology, 3 (2), pp. 137-146, Nov. 1990. 
[0010] Two methods of presenting a postal verifier 
with fraudulent evidence of payment are a counterfeited 
indicium and a copied indicium. The former is an unpaid 

so indicium that appears legitimate. The latter is a replay of 
a legitimate paid indicium. The present invention 
addresses the prevention of counterfeit indicium. 
[0011] A counterfeit indicium can be detected by 
verifying the digital token. Verification proves that a 

55 cryptographic algorithm generated the digital token with 
access to the secret meter key. The information printed 
in the indicium and access to a verifying key are suffi- 
cient for the detection of counterfeited indicia as long as 
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the secret meter key is confidential. In a public-key sys- 
tem, a digital signature provides the data authentication 
and integrity check. In a symmetric-key system, a mes- 
sage authentication code (MAC) provides a similar 
check. Detection of counterfeiting is an integrity check. 
[0012] Assuming integrity of the verification soft- 
ware and hardware, only a compromised meter secret- 
key can produce counterfeit indicia that pass an integrity 
check. This compromise could happen by violating the 
physical protection of the key by tampering, or by deriv- 
ing the key from indicia data by cryptanalysis. Generally, 
tampering is detectable if the physical protection of the 
secure component of the postage metering system is 
adequate, for example following FIPS 140-1, Security 
Requirements for Cryptographic Modules, National 
Institute for Standards and Technology, Jan. 1994. 
Robustness against cryptanalysis depends on the diffi- 
culty of solving certain mathematical problems, for 
example, discrete logarithm problems or factoring a 
large composite number. As part of its proposed Infor- 
mation-Based Indicia Program (IBIP), the USPS has 
proposed 1024 bit RSA or 1024 bit DSS as a measure 
of robustness. 

[0013] The IBIP is a distributed trusted system that 
is expected to support new methods of applying post- 
age in addition to, and eventually in lieu of, the current 
approach, which typically relies on a postage meter to 
mechanically print indicia on mailpieces. The IBIP 
requires printing large, high density, two-dimensional (2- 
D) bar codes on mailpieces. The Postal Service expects 
the IBIP to provide cost-effective assurance of postage 
payment for each mailpiece processed. 
[0014] The USPS has published draft specifications 
for the IBIP The INFORMATION BASED INDICIA PRO- 
GRAM (IBIP) INDICIUM SPECIFICATION, dated June 
13, 1996, defines the proposed requirements for a new 
indicium that will be applied to mail being processed 
using the IBIP The INFORMATION BASED INDICIA 
PROGRAM POSTAL SECURITY DEVICE SPECIFICA- 
TION, dated June 13, 1996, defines the proposed 
requirements for a Postal Security Device (PSD) that 
will provide security services to support the creation of 
a new "information based" postage postmark or indi- 
cium that will be applied to mail being processed using 
the IBIP The INFORMATION BASED INDICIA PRO- 
GRAM HOST SYSTEM SPECIFICATION, dated Octo- 
ber 9, 1996, defines the proposed requirements for a 
host system element of the IBIP The specifications are 
collectively referred to herein as the "IBIP Specifica- 
tions". The IBIP includes interfacing user (customer), 
postal and vendor infrastructures which are the system 
elements of the program. 

[0015] Presently, there are two postage metering 
types: closed systems and open systems. In a closed 
system, the system functionality is solely dedicated to 
metering activity. Examples of closed system metering 
devices include conventional digital and analog 
(mechanical and electronic) postage meters wherein a 



dedicated printer is securely coupled to a metering or 
accounting function. In a closed system, since the 
printer is securely coupled and dedicated to the meter, 
printing evidence of postage cannot take place without 
5 accounting for the evidence of postage. In an open sys- 
tem, the printer is not dedicated to the metering activity, 
freeing system functionality for multiple and diverse 
uses in addition to the metering activity. Examples of 
open system metering devices include personal compu- 
te ter (PC) based devices with single/multi-tasking operat- 
ing systems, multi-user applications and digital printers. 
An open system metering device is a postage evidenc- 
ing device with a non-dedicated printer that is not 
securely coupled to a secure accounting module. Open 
15 system indicia printed by the non-dedicated printer are 
made secure by including addressee information in the 
encrypted evidence of postage printed on the mailpiece 
for subsequent verification. 

[0016] Conventional closed system mechanical and 
20 electronic postage meters have heretofore secured the 
link between printing and accounting. The integrity of 
the physical meter box has been monitored by periodic 
inspections of the meters. Digital printing postage 
meters, which are closed system postage meters, typi- 
25 cally include a digital printer Coupled to a metering 
(accounting) device, which is referred to herein as a 
postal security device (PSD). Digital printing postage 
meters have removed the need for physical inspection 
by cryptographically securing the link between the 
30 accounting and printing mechanisms. In essence, new 
digital printing postage meters create a secure point to 
point communication link between the accounting unit 
and printhead. See, for example, U.S. Patent No. 
4,802,218, issued to Christopher B. Wright et al and 
35 now assigned to the assignee of the present invention. 
An example of a digital printing postage meter with 
secure printhead communication is the Personal Post 
Office™ manufactured by Pitney Bowes Inc. of Stam- 
ford, Connecticut. An example of a digital printing post- 
40 age meter in a secure housing is the PostPerfect™ also 
manufactured by Pitney Bowes Inc. of Stamford, Con- 
necticut. 

[0017] In U.S. Patent No. 5,682,427, a system is 
disclosed wherein either open or closed system indicia 

45 may be printed. The system includes a closed system 
meter coupled to a computer that is part of an open sys- 
tem meter. This hybrid system prints an open system 
indicium, i.e., with addressee information included in the 
evidence of postage payment, when the indicium is 

so printed simultaneously with the addressing of an enve- 
lope. The system prints a closed system indicium, i.e., 
without addressee information included in the evidence 
of postage payment, when the indicium is printed sepa- 
rately from the addressing of an envelope, for example, 

55 on pre-printed envelopes. 

[0018] One disadvantage with having two types of 
indicia is that two verification processes are needed. At 
the present, an indicium printed by an open system 
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meter includes addressee information in the encrypted 
evidence of postage printed on the mailpiece, but an 
indicium printed by a closed system meter does not. 
Thus, a verification system must recognize which type 
of indicium is being verified before performing an accu- 
rate verification. Such verification system may require 
separating the two indicium types for separate verifica- 
tion processing. 

[0019] In accordance with the present invention, 
closed system meters can print an open system indi- 
cium by scanning addressee information printed on a 
mailpiece before generating the indicium. In this man- 
ner, the present invention links an indicium with a mail- 
piece, and potentially eliminates the need for closed 
system indicia. Consequently, there would be only one 
type of indicium printed and, therefore, only one verifi- 
cation system would be needed to verify all digitally 
printed indicium. An additional benefit resulting from the 
present invention is that the verification system would 
detect any fraudulent use of duplicated indicia that are 
used to send mailpieces to different locations, whether 
generated by closed system or open system meters. 
[0020] In accordance with the preferred embodi- 
ment of the present invention, addressee information, 
such as a postal code or the entire address, is printed 
on the mailpiece, preferably in bar code format, when 
the envelope is addressed. The bar code is scanned by 
a bar code reader which is operatively coupled to a 
closed system postage meter, for example in a mailing 
machine that is processing the mailpiece. Alternatively, 
an optical character recognition (OCR) reader may scan 
an alphanumeric address printed on the mailpiece. The 
addressee information is then included in the informa- 
tion used to encode the indicium for postage evidenc- 
ing. At verification, the indicium is verified using the 
same verification process used for verifying open sys- 
tem indicium. 

[0021] In accordance with the present invention, 
system and method are provided for printing open sys- 
tem indicium on a closed system meter. 
[0022] The present invention links the indicium to 
the mailpiece by adding addressing information to an 
indicium printed by a closed system metering device. A 
scanning device is coupled to a closed system postage 
meter for scanning addressing information printed on a 
mailpiece. The addressing information is combined with 
other information relating to the postage payment for the 
mailpiece to obtain postal data relating to the mailpiece. 
The postal data, including the addressing information is 
used to generate an indicium for the mailpiece. The ind- 
icium includes cryptographic evidencing of postage pay- 
ment. The closed system metering device prints the 
indicium on the mailpiece. 

[0023] Therefore, it is now apparent that the present 
invention addresses the disadvantages associated with 
the prior art. Additional advantages of the invention will 
be set forth in the description, which follows, and in part 
will be obvious from the description, or may be learned 



by practice of the invention. The objects and advan- 
tages of the invention may be realized and obtained by 
means of the instrumentalities and combinations partic- 
ularly pointed out in the appended claims. 

5 [0024] The accompanying drawings, which are 
incorporated in and constitute a part of the specification, 
illustrate presently preferred embodiments of the inven- 
tion, and together with the general description given 
above and the detailed description of the preferred 

w embodiments given below, serve to explain the princi- 
ples of the invention. As shown throughout the draw- 
ings, like reference numerals designate like or 
corresponding parts. In the drawings: 

15 Fig. 1 is a preferred embodiment of a closed system 
metering device in accordance with an embodiment 
of the present invention; 

Fig. 2 is an alternate embodiment of a closed sys- 
tem metering device in accordance with another 
20 embodiment of the present invention; and 

Fig. 3 is a flow chart of a method for linking an indi- 
cium to a mailpiece for closed system meter 
devices of Figs. 1 and 2. 

25 [0025] With the advent of PC metering systems, 
such as set forth in the IBIP Specifications and in U.S. 
Patents Nos. 4,725,718, 4,743,747 and 5,781,438, the 
benefit of linking a mailpiece to an indicium has been 
recognized. The present invention enables closed sys- 

30 tern meters to link a destination address of a mailpiece 
to the indicium printed on the mailpiece. 
[0026] Referring now to Fig. 1, a closed system 
metering device is shown for printing a postal indicia on 
envelope 5 t which has an addressee block 10, and a 

35 return address 15. In a preferred embodiment of the 
present invention, the closed system metering device is 
a mailing machine, generally designated 100. Mailing 
machine 100 includes a processor 1 10, a scanner 120, 
a postage meter, generally designated 150, and an 

40 envelope transport 1 40. Meter 1 50 includes a processor 
152, non-volatile memory (NVM) 154, storage means 
156 and a digital printer 158. A typical closed system 
meter is described in more detail below. Scanner 120 
preferably is a bar code scanner for scanning 

45 addressee information printed on envelope 5 in bar 
code format. Alternatively, scanner 120 may be an OCR 
reader for reading the alphanumeric addressee infor- 
mation printed on envelope 5. 

[0027] The postage meter 150 includes a conven- 
so tional printing module 158. The printing module 158 
includes printing structure (not shown) such as any con- 
ventional thermal, ink jet, laser or other commercially 
available printing structure that is suitable for printing a 
digital indicium on envelope 5. Printing module 158 may 
55 include a conventional control circuit (not shown) which 
is connected to a microprocessor 152, as hereinafter 
described, and is conventionally constructed and 
arranged for communicating input signals thereto from 
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4 the scanner 120, and communicating control signals 
therefrom for operation of the printing, feeding and 
value setting structures, under the control of the micro- 
processor 152. Postage meter 150 additionally includes 
a keyboard 1 62 and a display 1 64. 5 
[0028] The postage meter 150 also preferably 
includes a suitable NVM 154. The NVM 154 preferably 
includes: structure for storing descending register (total 
postage currently available for printing) and ascending 
register (total of all postage value increments which 10 
have ever been entered, and thus been made available 
to the printing module 158 for printing by the postage 
meter 150, during the life of the postage meter 150). 
Preferably, the NVM 1 54 additionally includes conven- 
tional structure for storing the serial number of the post- is 
age meter 150. Further, depending on the type of 
printing structure 158 utilized in the postage meter 150, 
the NVM 154 may include conventional structure for 
storing data corresponding to a graphic image of a post- 
age indicium. Moreover, the NVM 154 is conventionally 20 
operable under the control of the microprocessor 152 
for decrementing the descending register and incre- 
menting the ascending register by an amount which is 
equal to the current requested postage value which is to 
be printed by the printing module 158. 25 
[0029] Referring now to Fig. 2, a first alternate 
embodiment of the present invention is shown in which 
a scanner 120, such as a barcode reader or OCR 
reader, is added to an existing stand-alone, closed sys- 
tem postage meter 150. The closed system postage 30 
meter 150 is coupled to scanner 120 in a conventional 
manner. Meter 150 includes a processor 152, NVM 154, 
storage means 156 and a printer 158. 
[0030] During mailpiece generation, elements of 
the address are used to generate a code specific to the 35 
mailpiece destination address. Such elements may be a 
postal code (zip code) or may include other elements 
such as a house number or street name. Once the code 
has been generated, it can be printed, preferably in bar 
code format, with the address, for example, in the 40 
address block of the mailpiece. A bar code is preferable 
because it is more reliable to scan in a bar code than to 
OCR scan the alphanumeric characters from the 
address block of the mailpiece. 

[0031 ] When the mailpiece is inserted into the post- 45 
age metering device, the address code is scanned from 
the mailpiece and transmitted to the metering device so 
that it can be encoded into the indicium. If the address 
code is used to generate a cryptographic signature or 
digital token, then the address code can be scanned 50 
during the verification process to verify the validity of the 
indicium as well as providing a link back to the mail- 
piece. For a description of the generation of a digital 
token, see U.S. Patent No. 5,781,438. 
[0032] Referring now to Fig. 3 with reference to 55 
Figs. 1 and 2, the process of linking an indicium printed 
by a closed system postage meter to the mailpiece on 
which it is printed. At step 400, scanner 120 scans the 



envelope to obtain at least addressee information 
printed on the envelope. At step 405, the scanner sends 
the scanned information to postage meter 150, which 
generates, at step 410, generates a digital indicium that 
comprises a cryptographic representation of postal data 
including the addressee information. At step 415, meter 
150 prints the digital indicium on the envelope. 
[0033] Many features of the embodiments disclosed 
herein represent design choices selected to best exploit 
the inventive concept as implemented in a particular vir- 
tual postage meter environment. However, those skilled 
in the art will recognize that various modifications can 
be made without departing from the spirit of the present 
invention. For example, the closed system postage 
meter 150 may be a virtual, closed system postage 
meter as described in European Patent Publication No. 
0927963. 

[0034] Therefore, the inventive concept in its 
broader aspects is not limited to the specific details of 
the preferred embodiments described above, but is 
defined by the appended claims and their equivalents. 

Claims 

1. A method for adding addressing information to an 
indicium printed by a closed system metering 
device, the method comprising: 

coupling a scanning device (120) to a closed 
system postage meter (150); 
scanning addressing information (10) printed 
on a mailpiece (5); 

combining the addressing information with 
other information relating to the postage pay- 
ment for the mailpiece (5) to obtain postal data 
relating to the mailpiece; 
using the postal data to generate an indicium 
for the mailpiece, the indicium including crypto- 
graphic evidencing of postage payment; and 
printing the indicium on the mailpiece (5). 

2. The method of Claim 1 wherein the scanning 
device (120) is a bar code reader and the address- 
ing information (10) scanned on the mailpiece is 
printed in bar code format. 

3. The method of Claim 1 or 2 wherein the crypto- 
graphic evidencing of postage payment is in the 
form of a digital signature. 

4. The method of Claim 1 , 2 or 3 wherein the other 
information relating to the mailpiece includes at 
least one of date of mailing, piece count, postage 
amount and an identification number of the closed 
system postage meter (150). 

5. A postage metering system comprising: 
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a closed system meter (150) including means 
for generating a digital indicium; 
means (158) for printing the digital indicium; 
means (120) operatively coupled to the closed 
system meter for scanning information printed 
on a mailpiece (5); and 

the generating means being operable to gener- 
ate the digital indicium using the scanned infor- 
mation and the printing means (158) to print 
the digital indicium on the mailpiece (5). 

6. The system of Claim 5 wherein the means for gen- 
erating a digital indicium includes means for per- 
forming a cryptographic operation using the 
scanned information. 

7. The system of Claim 5 or 6 wherein the scanning 
means (120) comprises a bar code scanner for 
scanning information printed in bar code format on 
the mailpiece (5). 

8. The system of Claim 5, 6 or 7 wherein the scanning 
means (120) comprises an OCR reader for scan- 
ning information printed in alphanumeric format on 
the mailpiece (5). 

9. The system of any one of Claims 5 to 8 wherein the 
closed system meter (1 50) is operatively coupled to 
a mailing machine (100). 
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SCAN ENVELOPE TO OBTAIN AT LEAST 
ADDRESSEE INFORMATION PRINTED ON THE 
ENVELOPE 



400 



SENDS THE SCANNED INFORMATION TO 
POSTAGE METER 



405 



GENERATE A DIGITAL INDICIUM THAT 
COMPRISES A CRYPTOGRAPHIC 
REPRESENTATION OF POSTAL DATA 
INCLUDING THE ADDRESSEE INFORMATION 



410 



PRINT THE DIGITAL INDICIUM ON THE 
ENVELOPE 
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